// ---------------------------------------------------------------------------// Cloud API — protected core API + public auth endpoints// --------------------------------------------------------------------------- import { HttpApi, HttpApiBuilder, HttpApiSwagger, HttpMiddleware, HttpRouter, HttpServer,} from "@effect/platform";import { Effect, Layer, Scope } from "effect";import { setCookie } from "@tanstack/react-start/server"; import { addGroup } from "@executor/api";import { CoreHandlers, ExecutorService, ExecutionEngineService } from "@executor/api/server";import { createExecutionEngine } from "@executor/execution";import { OpenApiGroup, OpenApiExtensionService, OpenApiHandlers } from "@executor/plugin-openapi/api";import { McpGroup, McpExtensionService, McpHandlers } from "@executor/plugin-mcp/api";import { GoogleDiscoveryGroup, GoogleDiscoveryExtensionService, GoogleDiscoveryHandlers,} from "@executor/plugin-google-discovery/api";import { GraphqlGroup, GraphqlExtensionService, GraphqlHandlers } from "@executor/plugin-graphql/api"; import { CloudAuthApi, CloudAuthPublicApi } from "./auth/api";import { AuthContext, UserStoreService } from "./auth/context";import { CloudAuthHandlers, CloudAuthPublicHandlers } from "./auth/handlers";import { WorkOSAuth } from "./auth/workos";import { DbService } from "./services/db";import { createTeamExecutor } from "./services/executor";import { server } from "./env"; const ProtectedCloudApi = addGroup(OpenApiGroup) .add(McpGroup) .add(GoogleDiscoveryGroup) .add(GraphqlGroup) .add(CloudAuthApi); const PublicCloudApi = HttpApi.make("cloudPublic") .add(CloudAuthPublicApi); const ProtectedCloudApiLive = HttpApiBuilder.api(ProtectedCloudApi).pipe( Layer.provide(CoreHandlers), Layer.provide(Layer.mergeAll( OpenApiHandlers, McpHandlers, GoogleDiscoveryHandlers, GraphqlHandlers, CloudAuthHandlers, )),); const PublicCloudApiLive = HttpApiBuilder.api(PublicCloudApi).pipe( Layer.provide(CloudAuthPublicHandlers),); const DbLive = DbService.Live;const UserStoreLive = UserStoreService.Live.pipe( Layer.provide(DbLive),); const SharedServices = Layer.mergeAll( DbLive, UserStoreLive, WorkOSAuth.Default, HttpServer.layerContext,); const sharedServicesScope = Effect.runSync(Scope.make());const SharedServicesMemoized = Effect.runSync( Layer.memoize(SharedServices).pipe( Scope.extend(sharedServicesScope), ),); const publicApiHandler = HttpApiBuilder.toWebHandler( PublicCloudApiLive.pipe( Layer.provideMerge(SharedServicesMemoized), Layer.provideMerge(HttpRouter.setRouterConfig({ maxParamLength: 1000 })), ), { middleware: HttpMiddleware.logger },); const parseCookie = (cookieHeader: string | null, name: string): string | null => { if (!cookieHeader) return null; const match = cookieHeader .split(";") .map((value) => value.trim()) .find((value) => value.startsWith(`${name}=`)); if (!match) return null; return match.slice(name.length + 1) || null;}; const isPublicPath = (pathname: string): boolean => pathname === "/auth/login" || pathname === "/auth/callback"; const unauthorized = (message: string): Response => Response.json({ error: message }, { status: 401 }); const COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 60 * 60 * 24 * 7, secure: server.NODE_ENV === "production",}; const resolveAuth = (request: Request) => Effect.gen(function* () { const workos = yield* WorkOSAuth; return yield* workos.authenticateRequest(request); }); const resolveTeamId = ( auth: { readonly userId: string; readonly email: string; readonly firstName: string | null | undefined; readonly lastName: string | null | undefined; readonly avatarUrl: string | null | undefined; }, cookieTeamId: string | null,) => Effect.gen(function* () { if (cookieTeamId) return cookieTeamId; const users = yield* UserStoreService; const teams = yield* users.use((store) => store.getTeamsForUser(auth.userId)); if (teams.length > 0) return teams[0]!.teamId; const user = yield* users.use((store) => store.upsertUser({ id: auth.userId, email: auth.email, name: `${auth.firstName ?? ""} ${auth.lastName ?? ""}`.trim() || undefined, avatarUrl: auth.avatarUrl ?? undefined, }), ); const team = yield* users.use((store) => store.createTeam(`${user.name ?? user.email}'s Team`), ); yield* users.use((store) => store.addMember(team.id, user.id, "owner")); return team.id; }); const resolveExecutor = (teamId: string) => Effect.gen(function* () { const users = yield* UserStoreService; const team = yield* users.use((store) => store.getTeam(teamId)); const teamName = team?.name ?? "Unknown Team"; const encryptionKey = server.ENCRYPTION_KEY; return yield* createTeamExecutor(teamId, teamName, encryptionKey); }); type ResolvedAuth = Exclude<Effect.Effect.Success<ReturnType<typeof resolveAuth>>, null>;type TeamExecutor = Effect.Effect.Success<ReturnType<typeof resolveExecutor>>; const createProtectedHandler = ( auth: ResolvedAuth, teamId: string, executor: TeamExecutor,) => { const engine = createExecutionEngine({ executor }); const requestServices = Layer.mergeAll( Layer.succeed(AuthContext, { userId: auth.userId, teamId, email: auth.email, name: `${auth.firstName ?? ""} ${auth.lastName ?? ""}`.trim() || null, avatarUrl: auth.avatarUrl ?? null, }), Layer.succeed(ExecutorService, executor), Layer.succeed(ExecutionEngineService, engine), Layer.succeed(OpenApiExtensionService, executor.openapi), Layer.succeed(McpExtensionService, executor.mcp), Layer.succeed(GoogleDiscoveryExtensionService, executor.googleDiscovery), Layer.succeed(GraphqlExtensionService, executor.graphql), ); return HttpApiBuilder.toWebHandler( HttpApiSwagger.layer({ path: "/docs" }).pipe( Layer.provideMerge(HttpApiBuilder.middlewareOpenApi()), Layer.provideMerge(ProtectedCloudApiLive), Layer.provideMerge(requestServices), Layer.provideMerge(SharedServicesMemoized), Layer.provideMerge(HttpRouter.setRouterConfig({ maxParamLength: 1000 })), ), { middleware: HttpMiddleware.logger }, );}; const closeExecutor = (executor: TeamExecutor) => executor.close().pipe( Effect.orElseSucceed(() => undefined), ); type ProtectedHandler = ReturnType<typeof createProtectedHandler>; const disposeProtectedHandler = (handler: ProtectedHandler) => Effect.promise(() => handler.dispose()).pipe( Effect.orElseSucceed(() => undefined), ); export const handleApiRequest = async (request: Request): Promise<Response> => { const pathname = new URL(request.url).pathname; if (isPublicPath(pathname)) { return publicApiHandler.handler(request); } const requestProgram = Effect.gen(function* () { const auth = yield* resolveAuth(request); if (!auth) return unauthorized("Unauthorized"); const cookieTeamId = parseCookie(request.headers.get("cookie"), "executor_team"); const teamId = yield* resolveTeamId(auth, cookieTeamId); const executor = yield* Effect.acquireRelease( resolveExecutor(teamId), closeExecutor, ); const handler = yield* Effect.acquireRelease( Effect.sync(() => createProtectedHandler(auth, teamId, executor)), disposeProtectedHandler, ); const response = yield* Effect.promise(() => handler.handler(request)); const refreshedSession = auth.refreshedSession; if (refreshedSession) { yield* Effect.sync(() => { setCookie("wos-session", refreshedSession, COOKIE_OPTIONS); }); } if (!cookieTeamId) { yield* Effect.sync(() => { setCookie("executor_team", teamId, COOKIE_OPTIONS); }); } return response; }); return Effect.runPromise( requestProgram.pipe( Effect.provide(SharedServicesMemoized), Effect.scoped, ), );};
// ---------------------------------------------------------------------------
// Cloud API — protected core API + public auth endpoints
// ---------------------------------------------------------------------------
import {
HttpApi,
HttpApiBuilder,
HttpApiSwagger,
HttpMiddleware,
HttpRouter,
HttpServer,
} from "@effect/platform";
import { Effect, Layer, Scope } from "effect";
import { setCookie } from "@tanstack/react-start/server";
import { addGroup } from "@executor/api";
import { CoreHandlers, ExecutorService, ExecutionEngineService } from "@executor/api/server";
import { createExecutionEngine } from "@executor/execution";
import { OpenApiGroup, OpenApiExtensionService, OpenApiHandlers } from "@executor/plugin-openapi/api";
import { McpGroup, McpExtensionService, McpHandlers } from "@executor/plugin-mcp/api";
import {
GoogleDiscoveryGroup,
GoogleDiscoveryExtensionService,
GoogleDiscoveryHandlers,
} from "@executor/plugin-google-discovery/api";
import { GraphqlGroup, GraphqlExtensionService, GraphqlHandlers } from "@executor/plugin-graphql/api";
import { CloudAuthApi, CloudAuthPublicApi } from "./auth/api";
import { AuthContext, UserStoreService } from "./auth/context";
import { CloudAuthHandlers, CloudAuthPublicHandlers } from "./auth/handlers";
import { WorkOSAuth } from "./auth/workos";
import { DbService } from "./services/db";
import { createTeamExecutor } from "./services/executor";
import { server } from "./env";
const ProtectedCloudApi = addGroup(OpenApiGroup)
.add(McpGroup)
.add(GoogleDiscoveryGroup)
.add(GraphqlGroup)
.add(CloudAuthApi);
const PublicCloudApi = HttpApi.make("cloudPublic")
.add(CloudAuthPublicApi);
const ProtectedCloudApiLive = HttpApiBuilder.api(ProtectedCloudApi).pipe(
Layer.provide(CoreHandlers),
Layer.provide(Layer.mergeAll(
OpenApiHandlers,
McpHandlers,
GoogleDiscoveryHandlers,
GraphqlHandlers,
CloudAuthHandlers,
)),
);
const PublicCloudApiLive = HttpApiBuilder.api(PublicCloudApi).pipe(
Layer.provide(CloudAuthPublicHandlers),
);
const DbLive = DbService.Live;
const UserStoreLive = UserStoreService.Live.pipe(
Layer.provide(DbLive),
);
const SharedServices = Layer.mergeAll(
DbLive,
UserStoreLive,
WorkOSAuth.Default,
HttpServer.layerContext,
);
const sharedServicesScope = Effect.runSync(Scope.make());
const SharedServicesMemoized = Effect.runSync(
Layer.memoize(SharedServices).pipe(
Scope.extend(sharedServicesScope),
),
);
const publicApiHandler = HttpApiBuilder.toWebHandler(
PublicCloudApiLive.pipe(
Layer.provideMerge(SharedServicesMemoized),
Layer.provideMerge(HttpRouter.setRouterConfig({ maxParamLength: 1000 })),
),
{ middleware: HttpMiddleware.logger },
);
const parseCookie = (cookieHeader: string | null, name: string): string | null => {
if (!cookieHeader) return null;
const match = cookieHeader
.split(";")
.map((value) => value.trim())
.find((value) => value.startsWith(`${name}=`));
if (!match) return null;
return match.slice(name.length + 1) || null;
};
const isPublicPath = (pathname: string): boolean =>
pathname === "/auth/login" || pathname === "/auth/callback";
const unauthorized = (message: string): Response =>
Response.json({ error: message }, { status: 401 });
const COOKIE_OPTIONS = {
path: "/",
httpOnly: true,
sameSite: "lax" as const,
maxAge: 60 * 60 * 24 * 7,
secure: server.NODE_ENV === "production",
};
const resolveAuth = (request: Request) =>
Effect.gen(function* () {
const workos = yield* WorkOSAuth;
return yield* workos.authenticateRequest(request);
});
const resolveTeamId = (
auth: {
readonly userId: string;
readonly email: string;
readonly firstName: string | null | undefined;
readonly lastName: string | null | undefined;
readonly avatarUrl: string | null | undefined;
},
cookieTeamId: string | null,
) =>
Effect.gen(function* () {
if (cookieTeamId) return cookieTeamId;
const users = yield* UserStoreService;
const teams = yield* users.use((store) => store.getTeamsForUser(auth.userId));
if (teams.length > 0) return teams[0]!.teamId;
const user = yield* users.use((store) =>
store.upsertUser({
id: auth.userId,
email: auth.email,
name: `${auth.firstName ?? ""} ${auth.lastName ?? ""}`.trim() || undefined,
avatarUrl: auth.avatarUrl ?? undefined,
}),
);
const team = yield* users.use((store) =>
store.createTeam(`${user.name ?? user.email}'s Team`),
);
yield* users.use((store) => store.addMember(team.id, user.id, "owner"));
return team.id;
});
const resolveExecutor = (teamId: string) =>
Effect.gen(function* () {
const users = yield* UserStoreService;
const team = yield* users.use((store) => store.getTeam(teamId));
const teamName = team?.name ?? "Unknown Team";
const encryptionKey = server.ENCRYPTION_KEY;
return yield* createTeamExecutor(teamId, teamName, encryptionKey);
});
type ResolvedAuth = Exclude<Effect.Effect.Success<ReturnType<typeof resolveAuth>>, null>;
type TeamExecutor = Effect.Effect.Success<ReturnType<typeof resolveExecutor>>;
const createProtectedHandler = (
auth: ResolvedAuth,
teamId: string,
executor: TeamExecutor,
) => {
const engine = createExecutionEngine({ executor });
const requestServices = Layer.mergeAll(
Layer.succeed(AuthContext, {
userId: auth.userId,
teamId,
email: auth.email,
name: `${auth.firstName ?? ""} ${auth.lastName ?? ""}`.trim() || null,
avatarUrl: auth.avatarUrl ?? null,
}),
Layer.succeed(ExecutorService, executor),
Layer.succeed(ExecutionEngineService, engine),
Layer.succeed(OpenApiExtensionService, executor.openapi),
Layer.succeed(McpExtensionService, executor.mcp),
Layer.succeed(GoogleDiscoveryExtensionService, executor.googleDiscovery),
Layer.succeed(GraphqlExtensionService, executor.graphql),
);
return HttpApiBuilder.toWebHandler(
HttpApiSwagger.layer({ path: "/docs" }).pipe(
Layer.provideMerge(HttpApiBuilder.middlewareOpenApi()),
Layer.provideMerge(ProtectedCloudApiLive),
Layer.provideMerge(requestServices),
Layer.provideMerge(SharedServicesMemoized),
Layer.provideMerge(HttpRouter.setRouterConfig({ maxParamLength: 1000 })),
),
{ middleware: HttpMiddleware.logger },
);
};
const closeExecutor = (executor: TeamExecutor) =>
executor.close().pipe(
Effect.orElseSucceed(() => undefined),
);
type ProtectedHandler = ReturnType<typeof createProtectedHandler>;
const disposeProtectedHandler = (handler: ProtectedHandler) =>
Effect.promise(() => handler.dispose()).pipe(
Effect.orElseSucceed(() => undefined),
);
export const handleApiRequest = async (request: Request): Promise<Response> => {
const pathname = new URL(request.url).pathname;
if (isPublicPath(pathname)) {
return publicApiHandler.handler(request);
}
const requestProgram = Effect.gen(function* () {
const auth = yield* resolveAuth(request);
if (!auth) return unauthorized("Unauthorized");
const cookieTeamId = parseCookie(request.headers.get("cookie"), "executor_team");
const teamId = yield* resolveTeamId(auth, cookieTeamId);
const executor = yield* Effect.acquireRelease(
resolveExecutor(teamId),
closeExecutor,
);
const handler = yield* Effect.acquireRelease(
Effect.sync(() => createProtectedHandler(auth, teamId, executor)),
disposeProtectedHandler,
);
const response = yield* Effect.promise(() => handler.handler(request));
const refreshedSession = auth.refreshedSession;
if (refreshedSession) {
yield* Effect.sync(() => {
setCookie("wos-session", refreshedSession, COOKIE_OPTIONS);
});
}
if (!cookieTeamId) {
yield* Effect.sync(() => {
setCookie("executor_team", teamId, COOKIE_OPTIONS);
});
}
return response;
});
return Effect.runPromise(
requestProgram.pipe(
Effect.provide(SharedServicesMemoized),
Effect.scoped,
),
);
};